I'll try and cut to the chase. Because I'm beginning to be in a hurry. I need Fox as I have to use internet banking for my monthly paying of my bills, and I have only in Fox some trust lingering, from among the javascipt enabled browsers that I could do those payments with.
But my not being able to decrypt the huge payload (we are just about coming to it next), is making me worry, and either I go and pay my bills at the counter instead of via the internet banking, or...
We still have dump_151029_1757_g0n_MozCloud.pcap open in Wireshark.
Enter the filter "tcp.stream eq 5" (without quotes).
Right click on any frame with TLS1.2, follow SSL stream, and save as:
dump_151029_1757_g0n_MozCloud_s5-ssl.dump
You should get:
Code: Select all
$ ls -l dump_151029_1757_g0n_MozCloud_s5-ssl.dump
-rw-r--r-- 1 miro miro 136352 2015-10-30 22:30 dump_151029_1757_g0n_MozCloud_s5-ssl.dump
$ ls -lh dump_151029_1757_g0n_MozCloud_s5-ssl.dump
-rw-r--r-- 1 miro miro 134K 2015-10-30 22:30 dump_151029_1757_g0n_MozCloud_s5-ssl.dump
Can't delve into it, in a hurry for reason stated above, but it's some tiny adobe managed video, in some likelihood, but it's partial content, I think I saw somewhere when following it (just open it with:
Code: Select all
$ hexedit dump_151029_1757_g0n_MozCloud_s5-ssl.dump
)
But it's this next stream... Do the same right click as before, but choose "Follow tcp stream" instead. And be patient. It's there, we have arrived at where the story might start to become interesting.
Be patient (unless you have a really powerful computor). Do save it as:
dump_151029_1757_g0n_MozCloud_s5.dump
but all those megabytes need a little time to reassemble from those some 40000 different frames (packets).
You should have this eventually:
Code: Select all
$ ls -l dump_151029_1757_g0n_MozCloud_s5.dump
-rw-r--r-- 1 miro miro 67764933 2015-10-30 22:41 dump_151029_1757_g0n_MozCloud_s5.dump
$ ls -lh dump_151029_1757_g0n_MozCloud_s5.dump
-rw-r--r-- 1 miro miro 65M 2015-10-30 22:41 dump_151029_1757_g0n_MozCloud_s5.dump
$
And here my insufficient knowledge, or encryped content (coming at it in a moment), makes me unable to view what those 65M contain.
Get ready to follow by studying "man hexedit" (emerge hexedit it you haven't yet).
Code: Select all
$ hexedit dump_151029_1757_g0n_MozCloud_s5.dump
Next, search for, in hex, string "474554" (without quotes), which is the string that GET'd content starts with, and take notice how many you find. They should be three (3) only.
Stay with the third 474554 that you found. Mark it. go to end. Copy.
You'll get a jocular warning ( my install is:
Code: Select all
# equery l hexedit
* Searching for hexedit ...
[IP-] [ ] app-editors/hexedit-1.2.13:0
#
):
Code: Select all
Hey, don't you think that's too big?!
Really copy (Yes/No)
Enjoy the joke, answer "y" and paste it into a file:
dump_151029_1757_g0n_MozCloud_s5_03.dump
Move again to the start of the third GET and truncate at that point.
Go to beginning, and from there get one, and another time to the start of GET. So you are at the second GET.
Just like before, mark, move to end, copy and paste into a file:
dump_151029_1757_g0n_MozCloud_s5_02.dump
To beginning, and move to the second GET, and truncate there.
Go to beginning, and from there go to the start of the last GET. Mark, move to end, copy and paste into a file:
dump_151029_1757_g0n_MozCloud_s5_01.dump
You should now have:
Code: Select all
$ ls -l dump_151029_1757_g0n_MozCloud_s5_0?.dump
-rw-r--r-- 1 miro miro 1484476 2015-10-30 23:36 dump_151029_1757_g0n_MozCloud_s5_01.dump
-rw-r--r-- 1 miro miro 13834287 2015-10-30 23:36 dump_151029_1757_g0n_MozCloud_s5_02.dump
-rw-r--r-- 1 miro miro 37479495 2015-10-30 23:35 dump_151029_1757_g0n_MozCloud_s5_03.dump
$ ls -lh dump_151029_1757_g0n_MozCloud_s5_0?.dump
-rw-r--r-- 1 miro miro 1.5M 2015-10-30 23:36 dump_151029_1757_g0n_MozCloud_s5_01.dump
-rw-r--r-- 1 miro miro 14M 2015-10-30 23:36 dump_151029_1757_g0n_MozCloud_s5_02.dump
-rw-r--r-- 1 miro miro 36M 2015-10-30 23:35 dump_151029_1757_g0n_MozCloud_s5_03.dump
$
Now, let's go get the gzip data, if we can:
Code: Select all
$ hexedit dump_151029_1757_g0n_MozCloud_s5_03.dump
Search, in hex, for "1F8B08" (without quotes). Only one found. Mark. Move to end. Copy. Paste into file:
dump_151029_1757_g0n_MozCloud_s5_03.gz
And here we go, where I have no idea how to get what that data is:
Code: Select all
$ file dump_151029_1757_g0n_MozCloud_s5_03.gz
dump_151029_1757_g0n_MozCloud_s5_03.gz: gzip compressed data, ASCII, extra field, encrypted
$
Do you see these unusual info the file command is telling us?
And sure, if I try:
Code: Select all
$ gunzip dump_151029_1757_g0n_MozCloud_s5_03.gz
gzip: dump_151029_1757_g0n_MozCloud_s5_03.gz is encrypted -- not supported
$
And it's similar, if I process 02.dump like that, with:
Code: Select all
$ file dump_151029_1757_g0n_MozCloud_s5_02.gz
dump_151029_1757_g0n_MozCloud_s5_02.gz: gzip compressed data, has CRC, extra field, has comment, encrypted, last modified: Sun Oct 19 05:36:28 2003
$ gunzip dump_151029_1757_g0n_MozCloud_s5_02.gz
gzip: dump_151029_1757_g0n_MozCloud_s5_02.gz is encrypted -- not supported
$
I'm not saying this isn't legitimate, as I don't know that it isn't.
Nor that it is legitimate.
I'm not so very bright, but neither stupid. I think I'll try and ask about this Mozilla devs, on their mailing list or some such place, or on Wireshark mailing list.
And in the meantime, I can't use Fox for internet banking, and the money that I need to pay, as every month, is due for payment...
Either I go to the bank or post office and pay over the counter (but what then do I have computers for?), or...
Regards!
EDIT 2015-11-01 21:06+01:00. corrected lapsus: 's/1F8B08/474554/'
